mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-12 04:37:38 +02:00
448 lines
9.1 KiB
JSON
448 lines
9.1 KiB
JSON
{
|
|
"$schema": "http://json-schema.org/schema#",
|
|
"id": "http://volatilityfoundation.org/intermediate-format/schema",
|
|
"title": "Symbol Container",
|
|
"type": "object",
|
|
"definitions": {
|
|
"metadata_producer": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"type": "string"
|
|
},
|
|
"datetime": {
|
|
"type": "string",
|
|
"format": "date-time"
|
|
}
|
|
}
|
|
},
|
|
"metadata_windows_pe": {
|
|
"type": "object",
|
|
"properties": {
|
|
"major": {
|
|
"type": "integer"
|
|
},
|
|
"minor": {
|
|
"type": "integer"
|
|
},
|
|
"revision": {
|
|
"type": "integer"
|
|
},
|
|
"build": {
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"major",
|
|
"minor",
|
|
"revision"
|
|
]
|
|
},
|
|
"metadata_windows_pdb": {
|
|
"type": "object",
|
|
"properties": {
|
|
"GUID": {
|
|
"type": "string"
|
|
},
|
|
"age": {
|
|
"type": "integer"
|
|
},
|
|
"database": {
|
|
"type": "string"
|
|
},
|
|
"machine_type": {
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"GUID",
|
|
"age",
|
|
"database",
|
|
"machine_type"
|
|
]
|
|
},
|
|
"metadata_windows": {
|
|
"type": "object",
|
|
"properties": {
|
|
"pe": {
|
|
"$ref": "#/definitions/metadata_windows_pe"
|
|
},
|
|
"pdb": {
|
|
"$ref": "#/definitions/metadata_windows_pdb"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"metadata_linux": {
|
|
"type": "object",
|
|
"$comment": "Reserved for future use"
|
|
},
|
|
"metadata_format": {
|
|
"type": "string",
|
|
"pattern": "^6.[0-9]+.[0-9]+$"
|
|
},
|
|
"metadata_source": {
|
|
"type": "object",
|
|
"properties": {
|
|
"type": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"element_metadata": {
|
|
"type": "object",
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"format": {
|
|
"$ref": "#/definitions/metadata_format"
|
|
},
|
|
"producer": {
|
|
"$ref": "#/definitions/metadata_producer"
|
|
}
|
|
},
|
|
"required": [
|
|
"format"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
{
|
|
"properties": {
|
|
"format": {
|
|
"$ref": "#/definitions/metadata_format"
|
|
},
|
|
"producer": {
|
|
"$ref": "#/definitions/metadata_producer"
|
|
},
|
|
"windows": {
|
|
"$ref": "#/definitions/metadata_windows"
|
|
}
|
|
},
|
|
"required": [
|
|
"format",
|
|
"windows"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
{
|
|
"properties": {
|
|
"format": {
|
|
"$ref": "#/definitions/metadata_format"
|
|
},
|
|
"producer": {
|
|
"$ref": "#/definitions/metadata_producer"
|
|
},
|
|
"linux": {
|
|
"$ref": "#/definitions/metadata_linux"
|
|
}
|
|
},
|
|
"required": [
|
|
"format",
|
|
"linux"
|
|
],
|
|
"additionalProperties": false
|
|
}
|
|
]
|
|
},
|
|
"element_enum": {
|
|
"properties": {
|
|
"size": {
|
|
"type": "integer"
|
|
},
|
|
"base": {
|
|
"type": "string"
|
|
},
|
|
"constants": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "integer"
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"size",
|
|
"base",
|
|
"constants"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"element_symbol": {
|
|
"properties": {
|
|
"address": {
|
|
"type": "number"
|
|
},
|
|
"linkage_name": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"$ref": "#/definitions/type_descriptor"
|
|
},
|
|
"constant_data": {
|
|
"type": "string",
|
|
"media": {
|
|
"binaryEncoding": "base64",
|
|
"readOnly": true
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"address"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"element_base_type": {
|
|
"properties": {
|
|
"size": {
|
|
"type": "integer"
|
|
},
|
|
"signed": {
|
|
"type": "boolean"
|
|
},
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^(void|int|float|char|bool)$"
|
|
},
|
|
"endian": {
|
|
"type": "string",
|
|
"pattern": "^(little|big)$"
|
|
}
|
|
},
|
|
"required": [
|
|
"size",
|
|
"kind",
|
|
"signed",
|
|
"endian"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"element_user_type": {
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^(struct|union|class)$"
|
|
},
|
|
"size": {
|
|
"type": "integer"
|
|
},
|
|
"fields": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/field"
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"size",
|
|
"fields"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"field": {
|
|
"properties": {
|
|
"type": {
|
|
"$ref": "#/definitions/type_descriptor"
|
|
},
|
|
"offset": {
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": [
|
|
"type",
|
|
"offset"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"type_descriptor": {
|
|
"oneOf": [
|
|
{
|
|
"$ref": "#/definitions/type_pointer"
|
|
},
|
|
{
|
|
"$ref": "#/definitions/type_base"
|
|
},
|
|
{
|
|
"$ref": "#/definitions/type_array"
|
|
},
|
|
{
|
|
"$ref": "#/definitions/type_struct"
|
|
},
|
|
{
|
|
"$ref": "#/definitions/type_enum"
|
|
},
|
|
{
|
|
"$ref": "#/definitions/type_function"
|
|
},
|
|
{
|
|
"$ref": "#/definitions/type_bitfield"
|
|
}
|
|
]
|
|
},
|
|
"type_pointer": {
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^pointer$"
|
|
},
|
|
"subtype": {
|
|
"$ref": "#/definitions/type_descriptor"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"subtype"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"type_base": {
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^base$"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"name"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"type_array": {
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^array$"
|
|
},
|
|
"subtype": {
|
|
"$ref": "#/definitions/type_descriptor"
|
|
},
|
|
"count": {
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"subtype",
|
|
"count"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"type_struct": {
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^(struct|class|union)$"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"name"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"type_enum": {
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^enum$"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"name"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"type_function": {
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^function$"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"type_bitfield": {
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"pattern": "^bitfield$"
|
|
},
|
|
"bit_position": {
|
|
"type": "integer"
|
|
},
|
|
"bit_length": {
|
|
"type": "integer"
|
|
},
|
|
"type": {
|
|
"oneOf": [
|
|
{
|
|
"$ref": "#/definitions/type_base"
|
|
},
|
|
{
|
|
"$ref": "#/definitions/type_enum"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"bit_position",
|
|
"bit_length",
|
|
"type"
|
|
],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"properties": {
|
|
"metadata": {
|
|
"$ref": "#/definitions/element_metadata"
|
|
},
|
|
"base_types": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/element_base_type"
|
|
}
|
|
},
|
|
"user_types": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/element_user_type"
|
|
}
|
|
},
|
|
"enums": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/element_enum"
|
|
}
|
|
},
|
|
"symbols": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/element_symbol"
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"metadata",
|
|
"base_types",
|
|
"user_types",
|
|
"enums",
|
|
"symbols"
|
|
],
|
|
"additionalProperties": false
|
|
}
|